feat: add Kulfi-backed tunnel mode

Summary

• add a --kulfi mode for exposing forwarded sandbox ports over Kulfi
• keep Kulfi identity state under shuru's data dir instead of the caller's repo
• avoid aborting shuru on routine Kulfi startup failures and validate explicit bridge-port conflicts before boot